101
88
except ImportError:
102
89
SO_BINDTODEVICE = None
104
if sys.version_info.major == 2:
108
92
stored_state_file = "clients.pickle"
110
94
logger = logging.getLogger()
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
116
103
except (OSError, AttributeError):
118
104
def if_nametoindex(interface):
119
105
"Get an interface index the hard way, i.e. using fcntl()"
120
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
121
107
with contextlib.closing(socket.socket()) as s:
122
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
109
struct.pack(str("16s16x"),
111
interface_index = struct.unpack(str("I"),
125
113
return interface_index
128
116
def initlogger(debug, level=logging.WARNING):
129
117
"""init logger and add loglevel"""
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
135
119
syslogger.setFormatter(logging.Formatter
136
120
('Mandos [%(process)d]: %(levelname)s:'
189
174
def password_encode(self, password):
190
175
# Passphrase can not be empty and can not contain newlines or
191
176
# NUL bytes. So we prefix it and hex encode it.
192
encoded = b"mandos" + binascii.hexlify(password)
193
if len(encoded) > 2048:
194
# GnuPG can't handle long passwords, so encode differently
195
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
.replace(b"\n", b"\\n")
197
.replace(b"\0", b"\\x00"))
177
return b"mandos" + binascii.hexlify(password)
200
179
def encrypt(self, data, password):
201
passphrase = self.password_encode(password)
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
204
passfile.write(passphrase)
206
proc = subprocess.Popen(['gpg', '--symmetric',
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
214
if proc.returncode != 0:
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
193
self.gnupg.passphrase = None
216
194
return ciphertext
218
196
def decrypt(self, data, password):
219
passphrase = self.password_encode(password)
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
222
passfile.write(passphrase)
224
proc = subprocess.Popen(['gpg', '--decrypt',
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
232
if proc.returncode != 0:
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
210
self.gnupg.passphrase = None
234
211
return decrypted_plaintext
237
214
class AvahiError(Exception):
238
215
def __init__(self, value, *args, **kwargs):
239
216
self.value = value
240
return super(AvahiError, self).__init__(value, *args,
217
super(AvahiError, self).__init__(value, *args, **kwargs)
218
def __unicode__(self):
219
return unicode(repr(self.value))
244
221
class AvahiServiceError(AvahiError):
248
224
class AvahiGroupError(AvahiError):
297
266
self.entry_group_state_changed_match = None
299
def rename(self, remove=True):
300
269
"""Derived from the Avahi example code"""
301
270
if self.rename_count >= self.max_renames:
302
271
logger.critical("No suitable Zeroconf service name found"
303
272
" after %i retries, exiting.",
304
273
self.rename_count)
305
274
raise AvahiServiceError("Too many renames")
307
self.server.GetAlternativeServiceName(self.name))
308
self.rename_count += 1
275
self.name = unicode(self.server
276
.GetAlternativeServiceName(self.name))
309
277
logger.info("Changing Zeroconf service name to %r ...",
315
282
except dbus.exceptions.DBusException as error:
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
321
logger.critical("D-Bus Exception", exc_info=error)
283
logger.critical("D-Bus Exception", exc_info=error)
286
self.rename_count += 1
325
288
def remove(self):
326
289
"""Derived from the Avahi example code"""
381
345
def server_state_changed(self, state, error=None):
382
346
"""Derived from the Avahi example code"""
383
347
logger.debug("Avahi server state change: %i", state)
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
348
bad_states = { avahi.SERVER_INVALID:
349
"Zeroconf server invalid",
350
avahi.SERVER_REGISTERING: None,
351
avahi.SERVER_COLLISION:
352
"Zeroconf server name collision",
353
avahi.SERVER_FAILURE:
354
"Zeroconf server failure" }
390
355
if state in bad_states:
391
356
if bad_states[state] is not None:
392
357
if error is None:
422
376
follow_name_owner_changes=True),
423
377
avahi.DBUS_INTERFACE_SERVER)
424
378
self.server.connect_to_signal("StateChanged",
425
self.server_state_changed)
379
self.server_state_changed)
426
380
self.server_state_changed(self.server.GetState())
429
383
class AvahiServiceToSyslog(AvahiService):
430
def rename(self, *args, **kwargs):
431
385
"""Add the new name to the syslog messages"""
432
ret = AvahiService.rename(self, *args, **kwargs)
433
syslogger.setFormatter(logging.Formatter(
434
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
386
ret = AvahiService.rename(self)
387
syslogger.setFormatter(logging.Formatter
388
('Mandos ({0}) [%(process)d]:'
389
' %(levelname)s: %(message)s'
438
def call_pipe(connection, # : multiprocessing.Connection
439
func, *args, **kwargs):
440
"""This function is meant to be called by multiprocessing.Process
442
This function runs func(*args, **kwargs), and writes the resulting
443
return value on the provided multiprocessing.Connection.
445
connection.send(func(*args, **kwargs))
394
def timedelta_to_milliseconds(td):
395
"Convert a datetime.timedelta() to milliseconds"
396
return ((td.days * 24 * 60 * 60 * 1000)
397
+ (td.seconds * 1000)
398
+ (td.microseconds // 1000))
448
401
class Client(object):
449
402
"""A representation of a client host served by this server.
496
446
"fingerprint", "host", "interval",
497
447
"last_approval_request", "last_checked_ok",
498
448
"last_enabled", "name", "timeout")
501
"extended_timeout": "PT15M",
503
"checker": "fping -q -- %%(host)s",
505
"approval_delay": "PT0S",
506
"approval_duration": "PT1S",
507
"approved_by_default": "True",
449
client_defaults = { "timeout": "5m",
450
"extended_timeout": "15m",
452
"checker": "fping -q -- %%(host)s",
454
"approval_delay": "0s",
455
"approval_duration": "1s",
456
"approved_by_default": "True",
460
def timeout_milliseconds(self):
461
"Return the 'timeout' attribute in milliseconds"
462
return timedelta_to_milliseconds(self.timeout)
464
def extended_timeout_milliseconds(self):
465
"Return the 'extended_timeout' attribute in milliseconds"
466
return timedelta_to_milliseconds(self.extended_timeout)
468
def interval_milliseconds(self):
469
"Return the 'interval' attribute in milliseconds"
470
return timedelta_to_milliseconds(self.interval)
472
def approval_delay_milliseconds(self):
473
return timedelta_to_milliseconds(self.approval_delay)
512
476
def config_parser(config):
590
551
self.current_checker_command = None
591
552
self.approved = None
592
553
self.approvals_pending = 0
593
self.changedstate = multiprocessing_manager.Condition(
594
multiprocessing_manager.Lock())
595
self.client_structure = [attr
596
for attr in self.__dict__.iterkeys()
554
self.changedstate = (multiprocessing_manager
555
.Condition(multiprocessing_manager
557
self.client_structure = [attr for attr in
558
self.__dict__.iterkeys()
597
559
if not attr.startswith("_")]
598
560
self.client_structure.append("client_structure")
600
for name, t in inspect.getmembers(
601
type(self), lambda obj: isinstance(obj, property)):
562
for name, t in inspect.getmembers(type(self),
602
566
if not name.startswith("_"):
603
567
self.client_structure.append(name)
646
610
# and every interval from then on.
647
611
if self.checker_initiator_tag is not None:
648
612
gobject.source_remove(self.checker_initiator_tag)
649
self.checker_initiator_tag = gobject.timeout_add(
650
int(self.interval.total_seconds() * 1000),
613
self.checker_initiator_tag = (gobject.timeout_add
614
(self.interval_milliseconds(),
652
616
# Schedule a disable() when 'timeout' has passed
653
617
if self.disable_initiator_tag is not None:
654
618
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = gobject.timeout_add(
656
int(self.timeout.total_seconds() * 1000), self.disable)
619
self.disable_initiator_tag = (gobject.timeout_add
620
(self.timeout_milliseconds(),
657
622
# Also start a new checker *right now*.
658
623
self.start_checker()
660
def checker_callback(self, source, condition, connection,
625
def checker_callback(self, pid, condition, command):
662
626
"""The checker has completed, so take appropriate actions."""
663
627
self.checker_callback_tag = None
664
628
self.checker = None
665
# Read return code from connection (see call_pipe)
666
returncode = connection.recv()
670
self.last_checker_status = returncode
671
self.last_checker_signal = None
629
if os.WIFEXITED(condition):
630
self.last_checker_status = os.WEXITSTATUS(condition)
672
631
if self.last_checker_status == 0:
673
632
logger.info("Checker for %(name)s succeeded",
675
634
self.checked_ok()
677
logger.info("Checker for %(name)s failed", vars(self))
636
logger.info("Checker for %(name)s failed",
679
639
self.last_checker_status = -1
680
self.last_checker_signal = -returncode
681
640
logger.warning("Checker for %(name)s crashed?",
685
643
def checked_ok(self):
686
644
"""Assert that the client has been seen, alive and well."""
687
645
self.last_checked_ok = datetime.datetime.utcnow()
688
646
self.last_checker_status = 0
689
self.last_checker_signal = None
690
647
self.bump_timeout()
692
649
def bump_timeout(self, timeout=None):
718
676
# than 'timeout' for the client to be disabled, which is as it
721
if self.checker is not None and not self.checker.is_alive():
722
logger.warning("Checker was not alive; joining")
679
# If a checker exists, make sure it is not a zombie
681
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
682
except (AttributeError, OSError) as error:
683
if (isinstance(error, OSError)
684
and error.errno != errno.ECHILD):
688
logger.warning("Checker was a zombie")
689
gobject.source_remove(self.checker_callback_tag)
690
self.checker_callback(pid, status,
691
self.current_checker_command)
725
692
# Start a new checker if needed
726
693
if self.checker is None:
727
694
# Escape attributes for the shell
729
attr: re.escape(str(getattr(self, attr)))
730
for attr in self.runtime_expansions }
695
escaped_attrs = dict(
696
(attr, re.escape(unicode(getattr(self, attr))))
698
self.runtime_expansions)
732
700
command = self.checker_command % escaped_attrs
733
701
except TypeError as error:
734
702
logger.error('Could not format string "%s"',
735
self.checker_command,
703
self.checker_command, exc_info=error)
704
return True # Try again later
705
self.current_checker_command = command
707
logger.info("Starting checker %r for %s",
709
# We don't need to redirect stdout and stderr, since
710
# in normal mode, that is already done by daemon(),
711
# and in debug mode we don't want to. (Stdin is
712
# always replaced by /dev/null.)
713
self.checker = subprocess.Popen(command,
716
except OSError as error:
717
logger.error("Failed to start subprocess",
737
return True # Try again later
738
self.current_checker_command = command
739
logger.info("Starting checker %r for %s", command,
741
# We don't need to redirect stdout and stderr, since
742
# in normal mode, that is already done by daemon(),
743
# and in debug mode we don't want to. (Stdin is
744
# always replaced by /dev/null.)
745
# The exception is when not debugging but nevertheless
746
# running in the foreground; use the previously
748
popen_args = { "close_fds": True,
751
if (not self.server_settings["debug"]
752
and self.server_settings["foreground"]):
753
popen_args.update({"stdout": wnull,
755
pipe = multiprocessing.Pipe(duplex = False)
756
self.checker = multiprocessing.Process(
758
args = (pipe[1], subprocess.call, command),
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
763
self.checker_callback, pipe[0], command)
719
self.checker_callback_tag = (gobject.child_watch_add
721
self.checker_callback,
723
# The checker may have completed before the gobject
724
# watch was added. Check for this.
725
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
727
gobject.source_remove(self.checker_callback_tag)
728
self.checker_callback(pid, status, command)
764
729
# Re-run this periodically if run by gobject.timeout_add
835
801
"""Decorator to annotate D-Bus methods, signals or properties
838
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
841
804
@dbus_service_property("org.example.Interface", signature="b",
806
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
807
"org.freedesktop.DBus.Property."
808
"EmitsChangedSignal": "false"})
843
809
def Property_dbus_property(self):
844
810
return dbus.Boolean(False)
846
See also the DBusObjectWithAnnotations class.
849
812
def decorator(func):
850
813
func._dbus_annotations = annotations
856
818
class DBusPropertyException(dbus.exceptions.DBusException):
857
819
"""A base class for D-Bus property-related exceptions
821
def __unicode__(self):
822
return unicode(str(self))
862
825
class DBusPropertyAccessException(DBusPropertyException):
885
849
If called like _is_dbus_thing("method") it returns a function
886
850
suitable for use as predicate to inspect.getmembers().
888
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
852
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
891
855
def _get_all_dbus_things(self, thing):
892
856
"""Returns a generator of (name, attribute) pairs
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
858
return ((getattr(athing.__get__(self), "_dbus_name",
895
860
athing.__get__(self))
896
861
for cls in self.__class__.__mro__
897
862
for name, athing in
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
900
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
902
path_keyword = 'object_path',
903
connection_keyword = 'connection')
904
def Introspect(self, object_path, connection):
905
"""Overloading of standard D-Bus method.
907
Inserts annotation tags on methods and signals.
909
xmlstring = dbus.service.Object.Introspect(self, object_path,
912
document = xml.dom.minidom.parseString(xmlstring)
914
for if_tag in document.getElementsByTagName("interface"):
915
# Add annotation tags
916
for typ in ("method", "signal"):
917
for tag in if_tag.getElementsByTagName(typ):
919
for name, prop in (self.
920
_get_all_dbus_things(typ)):
921
if (name == tag.getAttribute("name")
922
and prop._dbus_interface
923
== if_tag.getAttribute("name")):
924
annots.update(getattr(
925
prop, "_dbus_annotations", {}))
926
for name, value in annots.items():
927
ann_tag = document.createElement(
929
ann_tag.setAttribute("name", name)
930
ann_tag.setAttribute("value", value)
931
tag.appendChild(ann_tag)
932
# Add interface annotation tags
933
for annotation, value in dict(
934
itertools.chain.from_iterable(
935
annotations().items()
936
for name, annotations
937
in self._get_all_dbus_things("interface")
938
if name == if_tag.getAttribute("name")
940
ann_tag = document.createElement("annotation")
941
ann_tag.setAttribute("name", annotation)
942
ann_tag.setAttribute("value", value)
943
if_tag.appendChild(ann_tag)
944
# Fix argument name for the Introspect method itself
945
if (if_tag.getAttribute("name")
946
== dbus.INTROSPECTABLE_IFACE):
947
for cn in if_tag.getElementsByTagName("method"):
948
if cn.getAttribute("name") == "Introspect":
949
for arg in cn.getElementsByTagName("arg"):
950
if (arg.getAttribute("direction")
952
arg.setAttribute("name",
954
xmlstring = document.toxml("utf-8")
956
except (AttributeError, xml.dom.DOMException,
957
xml.parsers.expat.ExpatError) as error:
958
logger.error("Failed to override Introspection method",
963
class DBusObjectWithProperties(DBusObjectWithAnnotations):
964
"""A D-Bus object with properties.
966
Classes inheriting from this can use the dbus_service_property
967
decorator to expose methods as D-Bus properties. It exposes the
968
standard Get(), Set(), and GetAll() methods on the D-Bus.
863
inspect.getmembers(cls,
864
self._is_dbus_thing(thing)))
971
866
def _get_dbus_property(self, interface_name, property_name):
972
867
"""Returns a bound method if one exists which is a D-Bus
973
868
property with the specified name and interface.
975
for cls in self.__class__.__mro__:
976
for name, value in inspect.getmembers(
977
cls, self._is_dbus_thing("property")):
870
for cls in self.__class__.__mro__:
871
for name, value in (inspect.getmembers
873
self._is_dbus_thing("property"))):
978
874
if (value._dbus_name == property_name
979
875
and value._dbus_interface == interface_name):
980
876
return value.__get__(self)
982
878
# No such property
983
raise DBusPropertyNotFound("{}:{}.{}".format(
984
self.dbus_object_path, interface_name, property_name))
987
def _get_all_interface_names(cls):
988
"""Get a sequence of all interfaces supported by an object"""
989
return (name for name in set(getattr(getattr(x, attr),
990
"_dbus_interface", None)
991
for x in (inspect.getmro(cls))
995
@dbus.service.method(dbus.PROPERTIES_IFACE,
879
raise DBusPropertyNotFound(self.dbus_object_path + ":"
880
+ interface_name + "."
883
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
997
884
out_signature="v")
998
885
def Get(self, interface_name, property_name):
999
886
"""Standard D-Bus property Get() method, see D-Bus standard.
1088
961
if prop._dbus_interface
1089
962
== if_tag.getAttribute("name")):
1090
963
if_tag.appendChild(tag)
1091
# Add annotation tags for properties
1092
for tag in if_tag.getElementsByTagName("property"):
1094
for name, prop in self._get_all_dbus_things(
1096
if (name == tag.getAttribute("name")
1097
and prop._dbus_interface
1098
== if_tag.getAttribute("name")):
1099
annots.update(getattr(
1100
prop, "_dbus_annotations", {}))
1101
for name, value in annots.items():
1102
ann_tag = document.createElement(
1104
ann_tag.setAttribute("name", name)
1105
ann_tag.setAttribute("value", value)
1106
tag.appendChild(ann_tag)
964
# Add annotation tags
965
for typ in ("method", "signal", "property"):
966
for tag in if_tag.getElementsByTagName(typ):
968
for name, prop in (self.
969
_get_all_dbus_things(typ)):
970
if (name == tag.getAttribute("name")
971
and prop._dbus_interface
972
== if_tag.getAttribute("name")):
973
annots.update(getattr
977
for name, value in annots.iteritems():
978
ann_tag = document.createElement(
980
ann_tag.setAttribute("name", name)
981
ann_tag.setAttribute("value", value)
982
tag.appendChild(ann_tag)
983
# Add interface annotation tags
984
for annotation, value in dict(
985
itertools.chain.from_iterable(
986
annotations().iteritems()
987
for name, annotations in
988
self._get_all_dbus_things("interface")
989
if name == if_tag.getAttribute("name")
991
ann_tag = document.createElement("annotation")
992
ann_tag.setAttribute("name", annotation)
993
ann_tag.setAttribute("value", value)
994
if_tag.appendChild(ann_tag)
1107
995
# Add the names to the return values for the
1108
996
# "org.freedesktop.DBus.Properties" methods
1109
997
if (if_tag.getAttribute("name")
1127
1015
exc_info=error)
1128
1016
return xmlstring
1131
dbus.OBJECT_MANAGER_IFACE
1132
except AttributeError:
1133
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1135
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1136
"""A D-Bus object with an ObjectManager.
1138
Classes inheriting from this exposes the standard
1139
GetManagedObjects call and the InterfacesAdded and
1140
InterfacesRemoved signals on the standard
1141
"org.freedesktop.DBus.ObjectManager" interface.
1143
Note: No signals are sent automatically; they must be sent
1146
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1147
out_signature = "a{oa{sa{sv}}}")
1148
def GetManagedObjects(self):
1149
"""This function must be overridden"""
1150
raise NotImplementedError()
1152
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1153
signature = "oa{sa{sv}}")
1154
def InterfacesAdded(self, object_path, interfaces_and_properties):
1157
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1158
def InterfacesRemoved(self, object_path, interfaces):
1161
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1162
out_signature = "s",
1163
path_keyword = 'object_path',
1164
connection_keyword = 'connection')
1165
def Introspect(self, object_path, connection):
1166
"""Overloading of standard D-Bus method.
1168
Override return argument name of GetManagedObjects to be
1169
"objpath_interfaces_and_properties"
1171
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1175
document = xml.dom.minidom.parseString(xmlstring)
1177
for if_tag in document.getElementsByTagName("interface"):
1178
# Fix argument name for the GetManagedObjects method
1179
if (if_tag.getAttribute("name")
1180
== dbus.OBJECT_MANAGER_IFACE):
1181
for cn in if_tag.getElementsByTagName("method"):
1182
if (cn.getAttribute("name")
1183
== "GetManagedObjects"):
1184
for arg in cn.getElementsByTagName("arg"):
1185
if (arg.getAttribute("direction")
1189
"objpath_interfaces"
1191
xmlstring = document.toxml("utf-8")
1193
except (AttributeError, xml.dom.DOMException,
1194
xml.parsers.expat.ExpatError) as error:
1195
logger.error("Failed to override Introspection method",
1199
1019
def datetime_to_dbus(dt, variant_level=0):
1200
1020
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1202
1022
return dbus.String("", variant_level = variant_level)
1203
return dbus.String(dt.isoformat(), variant_level=variant_level)
1023
return dbus.String(dt.isoformat(),
1024
variant_level=variant_level)
1206
1027
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1237
1057
# Ignore non-D-Bus attributes, and D-Bus attributes
1238
1058
# with the wrong interface name
1239
1059
if (not hasattr(attribute, "_dbus_interface")
1240
or not attribute._dbus_interface.startswith(
1241
orig_interface_name)):
1060
or not attribute._dbus_interface
1061
.startswith(orig_interface_name)):
1243
1063
# Create an alternate D-Bus interface name based on
1244
1064
# the current name
1245
alt_interface = attribute._dbus_interface.replace(
1246
orig_interface_name, alt_interface_name)
1065
alt_interface = (attribute._dbus_interface
1066
.replace(orig_interface_name,
1067
alt_interface_name))
1247
1068
interface_names.add(alt_interface)
1248
1069
# Is this a D-Bus signal?
1249
1070
if getattr(attribute, "_dbus_is_signal", False):
1250
if sys.version_info.major == 2:
1251
# Extract the original non-method undecorated
1252
# function by black magic
1253
nonmethod_func = (dict(
1071
# Extract the original non-method function by
1073
nonmethod_func = (dict(
1254
1074
zip(attribute.func_code.co_freevars,
1255
attribute.__closure__))
1256
["func"].cell_contents)
1258
nonmethod_func = attribute
1075
attribute.__closure__))["func"]
1259
1077
# Create a new, but exactly alike, function
1260
1078
# object, and decorate it to be a new D-Bus signal
1261
1079
# with the alternate D-Bus interface name
1262
if sys.version_info.major == 2:
1263
new_function = types.FunctionType(
1264
nonmethod_func.func_code,
1265
nonmethod_func.func_globals,
1266
nonmethod_func.func_name,
1267
nonmethod_func.func_defaults,
1268
nonmethod_func.func_closure)
1270
new_function = types.FunctionType(
1271
nonmethod_func.__code__,
1272
nonmethod_func.__globals__,
1273
nonmethod_func.__name__,
1274
nonmethod_func.__defaults__,
1275
nonmethod_func.__closure__)
1276
new_function = (dbus.service.signal(
1278
attribute._dbus_signature)(new_function))
1080
new_function = (dbus.service.signal
1082
attribute._dbus_signature)
1083
(types.FunctionType(
1084
nonmethod_func.func_code,
1085
nonmethod_func.func_globals,
1086
nonmethod_func.func_name,
1087
nonmethod_func.func_defaults,
1088
nonmethod_func.func_closure)))
1279
1089
# Copy annotations, if any
1281
new_function._dbus_annotations = dict(
1282
attribute._dbus_annotations)
1091
new_function._dbus_annotations = (
1092
dict(attribute._dbus_annotations))
1283
1093
except AttributeError:
1285
1095
# Define a creator of a function to call both the
1312
1115
# object. Decorate it to be a new D-Bus method
1313
1116
# with the alternate D-Bus interface name. Add it
1314
1117
# to the class.
1316
dbus.service.method(
1318
attribute._dbus_in_signature,
1319
attribute._dbus_out_signature)
1320
(types.FunctionType(attribute.func_code,
1321
attribute.func_globals,
1322
attribute.func_name,
1323
attribute.func_defaults,
1324
attribute.func_closure)))
1118
attr[attrname] = (dbus.service.method
1120
attribute._dbus_in_signature,
1121
attribute._dbus_out_signature)
1123
(attribute.func_code,
1124
attribute.func_globals,
1125
attribute.func_name,
1126
attribute.func_defaults,
1127
attribute.func_closure)))
1325
1128
# Copy annotations, if any
1327
attr[attrname]._dbus_annotations = dict(
1328
attribute._dbus_annotations)
1130
attr[attrname]._dbus_annotations = (
1131
dict(attribute._dbus_annotations))
1329
1132
except AttributeError:
1331
1134
# Is this a D-Bus property?
1334
1137
# object, and decorate it to be a new D-Bus
1335
1138
# property with the alternate D-Bus interface
1336
1139
# name. Add it to the class.
1337
attr[attrname] = (dbus_service_property(
1338
alt_interface, attribute._dbus_signature,
1339
attribute._dbus_access,
1340
attribute._dbus_get_args_options
1342
(types.FunctionType(
1343
attribute.func_code,
1344
attribute.func_globals,
1345
attribute.func_name,
1346
attribute.func_defaults,
1347
attribute.func_closure)))
1140
attr[attrname] = (dbus_service_property
1142
attribute._dbus_signature,
1143
attribute._dbus_access,
1145
._dbus_get_args_options
1148
(attribute.func_code,
1149
attribute.func_globals,
1150
attribute.func_name,
1151
attribute.func_defaults,
1152
attribute.func_closure)))
1348
1153
# Copy annotations, if any
1350
attr[attrname]._dbus_annotations = dict(
1351
attribute._dbus_annotations)
1155
attr[attrname]._dbus_annotations = (
1156
dict(attribute._dbus_annotations))
1352
1157
except AttributeError:
1354
1159
# Is this a D-Bus interface?
1411
1213
Client.__init__(self, *args, **kwargs)
1412
1214
# Only now, when this client is initialized, can it show up on
1414
client_object_name = str(self.name).translate(
1216
client_object_name = unicode(self.name).translate(
1415
1217
{ord("."): ord("_"),
1416
1218
ord("-"): ord("_")})
1417
self.dbus_object_path = dbus.ObjectPath(
1418
"/clients/" + client_object_name)
1219
self.dbus_object_path = (dbus.ObjectPath
1220
("/clients/" + client_object_name))
1419
1221
DBusObjectWithProperties.__init__(self, self.bus,
1420
1222
self.dbus_object_path)
1422
def notifychangeproperty(transform_func, dbus_name,
1423
type_func=lambda x: x,
1425
invalidate_only=False,
1426
_interface=_interface):
1224
def notifychangeproperty(transform_func,
1225
dbus_name, type_func=lambda x: x,
1427
1227
""" Modify a variable so that it's a property which announces
1428
1228
its changes to DBus.
1434
1234
to the D-Bus. Default: no transform
1435
1235
variant_level: D-Bus variant level. Default: 1
1437
attrname = "_{}".format(dbus_name)
1237
attrname = "_{0}".format(dbus_name)
1439
1238
def setter(self, value):
1440
1239
if hasattr(self, "dbus_object_path"):
1441
1240
if (not hasattr(self, attrname) or
1442
1241
type_func(getattr(self, attrname, None))
1443
1242
!= type_func(value)):
1445
self.PropertiesChanged(
1446
_interface, dbus.Dictionary(),
1447
dbus.Array((dbus_name, )))
1449
dbus_value = transform_func(
1451
variant_level = variant_level)
1452
self.PropertyChanged(dbus.String(dbus_name),
1454
self.PropertiesChanged(
1456
dbus.Dictionary({ dbus.String(dbus_name):
1243
dbus_value = transform_func(type_func(value),
1246
self.PropertyChanged(dbus.String(dbus_name),
1459
1248
setattr(self, attrname, value)
1461
1250
return property(lambda self: getattr(self, attrname), setter)
1478
1267
datetime_to_dbus, "LastApprovalRequest")
1479
1268
approved_by_default = notifychangeproperty(dbus.Boolean,
1480
1269
"ApprovedByDefault")
1481
approval_delay = notifychangeproperty(
1482
dbus.UInt64, "ApprovalDelay",
1483
type_func = lambda td: td.total_seconds() * 1000)
1270
approval_delay = notifychangeproperty(dbus.UInt64,
1273
timedelta_to_milliseconds)
1484
1274
approval_duration = notifychangeproperty(
1485
1275
dbus.UInt64, "ApprovalDuration",
1486
type_func = lambda td: td.total_seconds() * 1000)
1276
type_func = timedelta_to_milliseconds)
1487
1277
host = notifychangeproperty(dbus.String, "Host")
1488
timeout = notifychangeproperty(
1489
dbus.UInt64, "Timeout",
1490
type_func = lambda td: td.total_seconds() * 1000)
1278
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1280
timedelta_to_milliseconds)
1491
1281
extended_timeout = notifychangeproperty(
1492
1282
dbus.UInt64, "ExtendedTimeout",
1493
type_func = lambda td: td.total_seconds() * 1000)
1494
interval = notifychangeproperty(
1495
dbus.UInt64, "Interval",
1496
type_func = lambda td: td.total_seconds() * 1000)
1283
type_func = timedelta_to_milliseconds)
1284
interval = notifychangeproperty(dbus.UInt64,
1287
timedelta_to_milliseconds)
1497
1288
checker_command = notifychangeproperty(dbus.String, "Checker")
1498
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1499
invalidate_only=True)
1501
1290
del notifychangeproperty
1509
1298
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1510
1299
Client.__del__(self, *args, **kwargs)
1512
def checker_callback(self, source, condition,
1513
connection, command, *args, **kwargs):
1514
ret = Client.checker_callback(self, source, condition,
1515
connection, command, *args,
1517
exitstatus = self.last_checker_status
1301
def checker_callback(self, pid, condition, command,
1303
self.checker_callback_tag = None
1305
if os.WIFEXITED(condition):
1306
exitstatus = os.WEXITSTATUS(condition)
1519
1307
# Emit D-Bus signal
1520
1308
self.CheckerCompleted(dbus.Int16(exitstatus),
1521
# This is specific to GNU libC
1522
dbus.Int64(exitstatus << 8),
1309
dbus.Int64(condition),
1523
1310
dbus.String(command))
1525
1312
# Emit D-Bus signal
1526
1313
self.CheckerCompleted(dbus.Int16(-1),
1528
# This is specific to GNU libC
1530
| self.last_checker_signal),
1314
dbus.Int64(condition),
1531
1315
dbus.String(command))
1317
return Client.checker_callback(self, pid, condition, command,
1534
1320
def start_checker(self, *args, **kwargs):
1535
old_checker_pid = getattr(self.checker, "pid", None)
1321
old_checker = self.checker
1322
if self.checker is not None:
1323
old_checker_pid = self.checker.pid
1325
old_checker_pid = None
1536
1326
r = Client.start_checker(self, *args, **kwargs)
1537
1327
# Only if new checker process was started
1538
1328
if (self.checker is not None
1653
1444
self.approved_by_default = bool(value)
1655
1446
# ApprovalDelay - property
1656
@dbus_service_property(_interface,
1447
@dbus_service_property(_interface, signature="t",
1658
1448
access="readwrite")
1659
1449
def ApprovalDelay_dbus_property(self, value=None):
1660
1450
if value is None: # get
1661
return dbus.UInt64(self.approval_delay.total_seconds()
1451
return dbus.UInt64(self.approval_delay_milliseconds())
1663
1452
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1665
1454
# ApprovalDuration - property
1666
@dbus_service_property(_interface,
1455
@dbus_service_property(_interface, signature="t",
1668
1456
access="readwrite")
1669
1457
def ApprovalDuration_dbus_property(self, value=None):
1670
1458
if value is None: # get
1671
return dbus.UInt64(self.approval_duration.total_seconds()
1459
return dbus.UInt64(timedelta_to_milliseconds(
1460
self.approval_duration))
1673
1461
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1675
1463
# Name - property
1677
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1678
1464
@dbus_service_property(_interface, signature="s", access="read")
1679
1465
def Name_dbus_property(self):
1680
1466
return dbus.String(self.name)
1682
1468
# Fingerprint - property
1684
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1685
1469
@dbus_service_property(_interface, signature="s", access="read")
1686
1470
def Fingerprint_dbus_property(self):
1687
1471
return dbus.String(self.fingerprint)
1689
1473
# Host - property
1690
@dbus_service_property(_interface,
1474
@dbus_service_property(_interface, signature="s",
1692
1475
access="readwrite")
1693
1476
def Host_dbus_property(self, value=None):
1694
1477
if value is None: # get
1695
1478
return dbus.String(self.host)
1696
self.host = str(value)
1479
self.host = unicode(value)
1698
1481
# Created - property
1700
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1701
1482
@dbus_service_property(_interface, signature="s", access="read")
1702
1483
def Created_dbus_property(self):
1703
1484
return datetime_to_dbus(self.created)
1767
1546
gobject.source_remove(self.disable_initiator_tag)
1768
self.disable_initiator_tag = gobject.timeout_add(
1769
int((self.expires - now).total_seconds() * 1000),
1547
self.disable_initiator_tag = (
1548
gobject.timeout_add(
1549
timedelta_to_milliseconds(self.expires - now),
1772
1552
# ExtendedTimeout - property
1773
@dbus_service_property(_interface,
1553
@dbus_service_property(_interface, signature="t",
1775
1554
access="readwrite")
1776
1555
def ExtendedTimeout_dbus_property(self, value=None):
1777
1556
if value is None: # get
1778
return dbus.UInt64(self.extended_timeout.total_seconds()
1557
return dbus.UInt64(self.extended_timeout_milliseconds())
1780
1558
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1782
1560
# Interval - property
1783
@dbus_service_property(_interface,
1561
@dbus_service_property(_interface, signature="t",
1785
1562
access="readwrite")
1786
1563
def Interval_dbus_property(self, value=None):
1787
1564
if value is None: # get
1788
return dbus.UInt64(self.interval.total_seconds() * 1000)
1565
return dbus.UInt64(self.interval_milliseconds())
1789
1566
self.interval = datetime.timedelta(0, 0, 0, value)
1790
1567
if getattr(self, "checker_initiator_tag", None) is None:
1792
1569
if self.enabled:
1793
1570
# Reschedule checker run
1794
1571
gobject.source_remove(self.checker_initiator_tag)
1795
self.checker_initiator_tag = gobject.timeout_add(
1796
value, self.start_checker)
1797
self.start_checker() # Start one now, too
1572
self.checker_initiator_tag = (gobject.timeout_add
1573
(value, self.start_checker))
1574
self.start_checker() # Start one now, too
1799
1576
# Checker - property
1800
@dbus_service_property(_interface,
1577
@dbus_service_property(_interface, signature="s",
1802
1578
access="readwrite")
1803
1579
def Checker_dbus_property(self, value=None):
1804
1580
if value is None: # get
1805
1581
return dbus.String(self.checker_command)
1806
self.checker_command = str(value)
1582
self.checker_command = unicode(value)
1808
1584
# CheckerRunning - property
1809
@dbus_service_property(_interface,
1585
@dbus_service_property(_interface, signature="b",
1811
1586
access="readwrite")
1812
1587
def CheckerRunning_dbus_property(self, value=None):
1813
1588
if value is None: # get
2044
1814
def fingerprint(openpgp):
2045
1815
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2046
1816
# New GnuTLS "datum" with the OpenPGP public key
2047
datum = gnutls.library.types.gnutls_datum_t(
2048
ctypes.cast(ctypes.c_char_p(openpgp),
2049
ctypes.POINTER(ctypes.c_ubyte)),
2050
ctypes.c_uint(len(openpgp)))
1817
datum = (gnutls.library.types
1818
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1821
ctypes.c_uint(len(openpgp))))
2051
1822
# New empty GnuTLS certificate
2052
1823
crt = gnutls.library.types.gnutls_openpgp_crt_t()
2053
gnutls.library.functions.gnutls_openpgp_crt_init(
1824
(gnutls.library.functions
1825
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2055
1826
# Import the OpenPGP public key into the certificate
2056
gnutls.library.functions.gnutls_openpgp_crt_import(
2057
crt, ctypes.byref(datum),
2058
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1827
(gnutls.library.functions
1828
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1829
gnutls.library.constants
1830
.GNUTLS_OPENPGP_FMT_RAW))
2059
1831
# Verify the self signature in the key
2060
1832
crtverify = ctypes.c_uint()
2061
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
2062
crt, 0, ctypes.byref(crtverify))
1833
(gnutls.library.functions
1834
.gnutls_openpgp_crt_verify_self(crt, 0,
1835
ctypes.byref(crtverify)))
2063
1836
if crtverify.value != 0:
2064
1837
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2065
raise gnutls.errors.CertificateSecurityError(
1838
raise (gnutls.errors.CertificateSecurityError
2067
1840
# New buffer for the fingerprint
2068
1841
buf = ctypes.create_string_buffer(20)
2069
1842
buf_len = ctypes.c_size_t()
2070
1843
# Get the fingerprint from the certificate into the buffer
2071
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
2072
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1844
(gnutls.library.functions
1845
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1846
ctypes.byref(buf_len)))
2073
1847
# Deinit the certificate
2074
1848
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2075
1849
# Convert the buffer to a Python bytestring
2177
1946
self.interface)
2180
self.socket.setsockopt(
2181
socket.SOL_SOCKET, SO_BINDTODEVICE,
2182
(self.interface + "\0").encode("utf-8"))
1949
self.socket.setsockopt(socket.SOL_SOCKET,
2183
1953
except socket.error as error:
2184
1954
if error.errno == errno.EPERM:
2185
logger.error("No permission to bind to"
2186
" interface %s", self.interface)
1955
logger.error("No permission to"
1956
" bind to interface %s",
2187
1958
elif error.errno == errno.ENOPROTOOPT:
2188
1959
logger.error("SO_BINDTODEVICE not available;"
2189
1960
" cannot bind to interface %s",
2190
1961
self.interface)
2191
1962
elif error.errno == errno.ENODEV:
2192
logger.error("Interface %s does not exist,"
2193
" cannot bind", self.interface)
1963
logger.error("Interface %s does not"
1964
" exist, cannot bind",
2196
1968
# Only bind(2) the socket if we really need to.
2253
2020
def add_pipe(self, parent_pipe, proc):
2254
2021
# Call "handle_ipc" for both data and EOF events
2255
gobject.io_add_watch(
2256
parent_pipe.fileno(),
2257
gobject.IO_IN | gobject.IO_HUP,
2258
functools.partial(self.handle_ipc,
2259
parent_pipe = parent_pipe,
2022
gobject.io_add_watch(parent_pipe.fileno(),
2023
gobject.IO_IN | gobject.IO_HUP,
2024
functools.partial(self.handle_ipc,
2262
def handle_ipc(self, source, condition,
2265
client_object=None):
2029
def handle_ipc(self, source, condition, parent_pipe=None,
2030
proc = None, client_object=None):
2266
2031
# error, or the other end of multiprocessing.Pipe has closed
2267
2032
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2268
2033
# Wait for other process to exit
2331
def rfc3339_duration_to_delta(duration):
2332
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2334
>>> rfc3339_duration_to_delta("P7D")
2335
datetime.timedelta(7)
2336
>>> rfc3339_duration_to_delta("PT60S")
2337
datetime.timedelta(0, 60)
2338
>>> rfc3339_duration_to_delta("PT60M")
2339
datetime.timedelta(0, 3600)
2340
>>> rfc3339_duration_to_delta("PT24H")
2341
datetime.timedelta(1)
2342
>>> rfc3339_duration_to_delta("P1W")
2343
datetime.timedelta(7)
2344
>>> rfc3339_duration_to_delta("PT5M30S")
2345
datetime.timedelta(0, 330)
2346
>>> rfc3339_duration_to_delta("P1DT3M20S")
2347
datetime.timedelta(1, 200)
2350
# Parsing an RFC 3339 duration with regular expressions is not
2351
# possible - there would have to be multiple places for the same
2352
# values, like seconds. The current code, while more esoteric, is
2353
# cleaner without depending on a parsing library. If Python had a
2354
# built-in library for parsing we would use it, but we'd like to
2355
# avoid excessive use of external libraries.
2357
# New type for defining tokens, syntax, and semantics all-in-one
2358
Token = collections.namedtuple("Token", (
2359
"regexp", # To match token; if "value" is not None, must have
2360
# a "group" containing digits
2361
"value", # datetime.timedelta or None
2362
"followers")) # Tokens valid after this token
2363
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2364
# the "duration" ABNF definition in RFC 3339, Appendix A.
2365
token_end = Token(re.compile(r"$"), None, frozenset())
2366
token_second = Token(re.compile(r"(\d+)S"),
2367
datetime.timedelta(seconds=1),
2368
frozenset((token_end, )))
2369
token_minute = Token(re.compile(r"(\d+)M"),
2370
datetime.timedelta(minutes=1),
2371
frozenset((token_second, token_end)))
2372
token_hour = Token(re.compile(r"(\d+)H"),
2373
datetime.timedelta(hours=1),
2374
frozenset((token_minute, token_end)))
2375
token_time = Token(re.compile(r"T"),
2377
frozenset((token_hour, token_minute,
2379
token_day = Token(re.compile(r"(\d+)D"),
2380
datetime.timedelta(days=1),
2381
frozenset((token_time, token_end)))
2382
token_month = Token(re.compile(r"(\d+)M"),
2383
datetime.timedelta(weeks=4),
2384
frozenset((token_day, token_end)))
2385
token_year = Token(re.compile(r"(\d+)Y"),
2386
datetime.timedelta(weeks=52),
2387
frozenset((token_month, token_end)))
2388
token_week = Token(re.compile(r"(\d+)W"),
2389
datetime.timedelta(weeks=1),
2390
frozenset((token_end, )))
2391
token_duration = Token(re.compile(r"P"), None,
2392
frozenset((token_year, token_month,
2393
token_day, token_time,
2395
# Define starting values
2396
value = datetime.timedelta() # Value so far
2398
followers = frozenset((token_duration, )) # Following valid tokens
2399
s = duration # String left to parse
2400
# Loop until end token is found
2401
while found_token is not token_end:
2402
# Search for any currently valid tokens
2403
for token in followers:
2404
match = token.regexp.match(s)
2405
if match is not None:
2407
if token.value is not None:
2408
# Value found, parse digits
2409
factor = int(match.group(1), 10)
2410
# Add to value so far
2411
value += factor * token.value
2412
# Strip token from string
2413
s = token.regexp.sub("", s, 1)
2416
# Set valid next tokens
2417
followers = found_token.followers
2420
# No currently valid tokens were found
2421
raise ValueError("Invalid RFC 3339 duration: {!r}"
2427
2096
def string_to_delta(interval):
2428
2097
"""Parse a string and return a datetime.timedelta
2527
2191
parser.add_argument("--no-dbus", action="store_false",
2528
2192
dest="use_dbus", help="Do not provide D-Bus"
2529
" system bus interface", default=None)
2193
" system bus interface")
2530
2194
parser.add_argument("--no-ipv6", action="store_false",
2531
dest="use_ipv6", help="Do not use IPv6",
2195
dest="use_ipv6", help="Do not use IPv6")
2533
2196
parser.add_argument("--no-restore", action="store_false",
2534
2197
dest="restore", help="Do not restore stored"
2535
" state", default=None)
2536
2199
parser.add_argument("--socket", type=int,
2537
2200
help="Specify a file descriptor to a network"
2538
2201
" socket to use instead of creating one")
2539
2202
parser.add_argument("--statedir", metavar="DIR",
2540
2203
help="Directory to save/restore state in")
2541
parser.add_argument("--foreground", action="store_true",
2542
help="Run in foreground", default=None)
2543
parser.add_argument("--no-zeroconf", action="store_false",
2544
dest="zeroconf", help="Do not use Zeroconf",
2547
2205
options = parser.parse_args()
2549
2207
if options.check:
2551
fail_count, test_count = doctest.testmod()
2552
sys.exit(os.EX_OK if fail_count == 0 else 1)
2554
2212
# Default values for config file for server-global settings
2555
2213
server_defaults = { "interface": "",
2558
2216
"debug": "False",
2560
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2561
":+SIGN-DSA-SHA256",
2218
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2562
2219
"servicename": "Mandos",
2563
2220
"use_dbus": "True",
2564
2221
"use_ipv6": "True",
2565
2222
"debuglevel": "",
2566
2223
"restore": "True",
2568
"statedir": "/var/lib/mandos",
2569
"foreground": "False",
2225
"statedir": "/var/lib/mandos"
2573
2228
# Parse config file for server-global settings
2574
2229
server_config = configparser.SafeConfigParser(server_defaults)
2575
2230
del server_defaults
2576
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2231
server_config.read(os.path.join(options.configdir,
2577
2233
# Convert the SafeConfigParser object to a dict
2578
2234
server_settings = server_config.defaults()
2579
2235
# Use the appropriate methods on the non-string config options
2580
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2236
for option in ("debug", "use_dbus", "use_ipv6"):
2581
2237
server_settings[option] = server_config.getboolean("DEFAULT",
2583
2239
if server_settings["port"]:
2597
2253
# Override the settings from the config file with command line
2598
2254
# options, if set.
2599
2255
for option in ("interface", "address", "port", "debug",
2600
"priority", "servicename", "configdir", "use_dbus",
2601
"use_ipv6", "debuglevel", "restore", "statedir",
2602
"socket", "foreground", "zeroconf"):
2256
"priority", "servicename", "configdir",
2257
"use_dbus", "use_ipv6", "debuglevel", "restore",
2258
"statedir", "socket"):
2603
2259
value = getattr(options, option)
2604
2260
if value is not None:
2605
2261
server_settings[option] = value
2607
2263
# Force all strings to be unicode
2608
2264
for option in server_settings.keys():
2609
if isinstance(server_settings[option], bytes):
2610
server_settings[option] = (server_settings[option]
2612
# Force all boolean options to be boolean
2613
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2614
"foreground", "zeroconf"):
2615
server_settings[option] = bool(server_settings[option])
2616
# Debug implies foreground
2617
if server_settings["debug"]:
2618
server_settings["foreground"] = True
2265
if type(server_settings[option]) is str:
2266
server_settings[option] = unicode(server_settings[option])
2619
2267
# Now we have our good server settings in "server_settings"
2621
2269
##################################################################
2623
if (not server_settings["zeroconf"]
2624
and not (server_settings["port"]
2625
or server_settings["socket"] != "")):
2626
parser.error("Needs port or socket to work without Zeroconf")
2628
2271
# For convenience
2629
2272
debug = server_settings["debug"]
2630
2273
debuglevel = server_settings["debuglevel"]
2659
2301
global mandos_dbus_service
2660
2302
mandos_dbus_service = None
2663
if server_settings["socket"] != "":
2664
socketfd = server_settings["socket"]
2665
tcp_server = MandosServer(
2666
(server_settings["address"], server_settings["port"]),
2668
interface=(server_settings["interface"] or None),
2670
gnutls_priority=server_settings["priority"],
2674
pidfilename = "/run/mandos.pid"
2675
if not os.path.isdir("/run/."):
2676
pidfilename = "/var/run/mandos.pid"
2304
tcp_server = MandosServer((server_settings["address"],
2305
server_settings["port"]),
2307
interface=(server_settings["interface"]
2311
server_settings["priority"],
2313
socketfd=(server_settings["socket"]
2316
pidfilename = "/var/run/mandos.pid"
2679
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2318
pidfile = open(pidfilename, "w")
2680
2319
except IOError as e:
2681
2320
logger.error("Could not open file %r", pidfilename,
2738
2377
bus_name = dbus.service.BusName("se.recompile.Mandos",
2741
old_bus_name = dbus.service.BusName(
2742
"se.bsnet.fukt.Mandos", bus,
2744
except dbus.exceptions.DBusException as e:
2378
bus, do_not_queue=True)
2379
old_bus_name = (dbus.service.BusName
2380
("se.bsnet.fukt.Mandos", bus,
2382
except dbus.exceptions.NameExistsException as e:
2745
2383
logger.error("Disabling D-Bus:", exc_info=e)
2746
2384
use_dbus = False
2747
2385
server_settings["use_dbus"] = False
2748
2386
tcp_server.use_dbus = False
2750
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2751
service = AvahiServiceToSyslog(
2752
name = server_settings["servicename"],
2753
servicetype = "_mandos._tcp",
2754
protocol = protocol,
2756
if server_settings["interface"]:
2757
service.interface = if_nametoindex(
2758
server_settings["interface"].encode("utf-8"))
2387
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2388
service = AvahiServiceToSyslog(name =
2389
server_settings["servicename"],
2390
servicetype = "_mandos._tcp",
2391
protocol = protocol, bus = bus)
2392
if server_settings["interface"]:
2393
service.interface = (if_nametoindex
2394
(str(server_settings["interface"])))
2760
2396
global multiprocessing_manager
2761
2397
multiprocessing_manager = multiprocessing.Manager()
2768
2404
old_client_settings = {}
2769
2405
clients_data = {}
2771
# This is used to redirect stdout and stderr for checker processes
2773
wnull = open(os.devnull, "w") # A writable /dev/null
2774
# Only used if server is running in foreground but not in debug
2776
if debug or not foreground:
2779
2407
# Get client data and settings from last running state.
2780
2408
if server_settings["restore"]:
2782
2410
with open(stored_state_path, "rb") as stored_state:
2783
clients_data, old_client_settings = pickle.load(
2411
clients_data, old_client_settings = (pickle.load
2785
2413
os.remove(stored_state_path)
2786
2414
except IOError as e:
2787
2415
if e.errno == errno.ENOENT:
2788
logger.warning("Could not load persistent state:"
2789
" {}".format(os.strerror(e.errno)))
2416
logger.warning("Could not load persistent state: {0}"
2417
.format(os.strerror(e.errno)))
2791
2419
logger.critical("Could not load persistent state:",
2794
2422
except EOFError as e:
2795
2423
logger.warning("Could not load persistent state: "
2424
"EOFError:", exc_info=e)
2799
2426
with PGPEngine() as pgp:
2800
for client_name, client in clients_data.items():
2801
# Skip removed clients
2802
if client_name not in client_settings:
2427
for client_name, client in clients_data.iteritems():
2805
2428
# Decide which value to use after restoring saved state.
2806
2429
# We have three different values: Old config file,
2807
2430
# new config file, and saved state.
2828
2451
if datetime.datetime.utcnow() >= client["expires"]:
2829
2452
if not client["last_checked_ok"]:
2830
2453
logger.warning(
2831
"disabling client {} - Client never "
2832
"performed a successful checker".format(
2454
"disabling client {0} - Client never "
2455
"performed a successful checker"
2456
.format(client_name))
2834
2457
client["enabled"] = False
2835
2458
elif client["last_checker_status"] != 0:
2836
2459
logger.warning(
2837
"disabling client {} - Client last"
2838
" checker failed with error code"
2841
client["last_checker_status"]))
2460
"disabling client {0} - Client "
2461
"last checker failed with error code {1}"
2462
.format(client_name,
2463
client["last_checker_status"]))
2842
2464
client["enabled"] = False
2844
client["expires"] = (
2845
datetime.datetime.utcnow()
2846
+ client["timeout"])
2466
client["expires"] = (datetime.datetime
2468
+ client["timeout"])
2847
2469
logger.debug("Last checker succeeded,"
2848
" keeping {} enabled".format(
2470
" keeping {0} enabled"
2471
.format(client_name))
2851
client["secret"] = pgp.decrypt(
2852
client["encrypted_secret"],
2853
client_settings[client_name]["secret"])
2473
client["secret"] = (
2474
pgp.decrypt(client["encrypted_secret"],
2475
client_settings[client_name]
2854
2477
except PGPError:
2855
2478
# If decryption fails, we use secret from new settings
2856
logger.debug("Failed to decrypt {} old secret".format(
2858
client["secret"] = (client_settings[client_name]
2479
logger.debug("Failed to decrypt {0} old secret"
2480
.format(client_name))
2481
client["secret"] = (
2482
client_settings[client_name]["secret"])
2861
2484
# Add/remove clients based on new changes made to config
2862
2485
for client_name in (set(old_client_settings)
2867
2490
clients_data[client_name] = client_settings[client_name]
2869
2492
# Create all client objects
2870
for client_name, client in clients_data.items():
2493
for client_name, client in clients_data.iteritems():
2871
2494
tcp_server.clients[client_name] = client_class(
2874
server_settings = server_settings)
2495
name = client_name, settings = client)
2876
2497
if not tcp_server.clients:
2877
2498
logger.warning("No clients defined")
2880
if pidfile is not None:
2884
print(pid, file=pidfile)
2886
logger.error("Could not write to file %r with PID %d",
2504
pidfile.write(str(pid) + "\n".encode("utf-8"))
2507
logger.error("Could not write to file %r with PID %d",
2510
# "pidfile" was never created
2889
2512
del pidfilename
2891
2514
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2892
2515
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2896
@alternate_dbus_interfaces(
2897
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2898
class MandosDBusService(DBusObjectWithObjectManager):
2518
@alternate_dbus_interfaces({"se.recompile.Mandos":
2519
"se.bsnet.fukt.Mandos"})
2520
class MandosDBusService(DBusObjectWithProperties):
2899
2521
"""A D-Bus proxy object"""
2901
2522
def __init__(self):
2902
2523
dbus.service.Object.__init__(self, bus, "/")
2904
2524
_interface = "se.recompile.Mandos"
2526
@dbus_interface_annotations(_interface)
2528
return { "org.freedesktop.DBus.Property"
2529
".EmitsChangedSignal":
2906
2532
@dbus.service.signal(_interface, signature="o")
2907
2533
def ClientAdded(self, objpath):
2916
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2918
2542
@dbus.service.signal(_interface, signature="os")
2919
2543
def ClientRemoved(self, objpath, name):
2923
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2925
2547
@dbus.service.method(_interface, out_signature="ao")
2926
2548
def GetAllClients(self):
2928
return dbus.Array(c.dbus_object_path for c in
2550
return dbus.Array(c.dbus_object_path
2929
2552
tcp_server.clients.itervalues())
2931
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2933
2554
@dbus.service.method(_interface,
2934
2555
out_signature="a{oa{sv}}")
2935
2556
def GetAllClientsWithProperties(self):
2937
2558
return dbus.Dictionary(
2938
{ c.dbus_object_path: c.GetAll(
2939
"se.recompile.Mandos.Client")
2940
for c in tcp_server.clients.itervalues() },
2559
((c.dbus_object_path, c.GetAll(""))
2560
for c in tcp_server.clients.itervalues()),
2941
2561
signature="oa{sv}")
2943
2563
@dbus.service.method(_interface, in_signature="o")
2947
2567
if c.dbus_object_path == object_path:
2948
2568
del tcp_server.clients[c.name]
2949
2569
c.remove_from_connection()
2950
# Don't signal the disabling
2570
# Don't signal anything except ClientRemoved
2951
2571
c.disable(quiet=True)
2952
# Emit D-Bus signal for removal
2953
self.client_removed_signal(c)
2573
self.ClientRemoved(object_path, c.name)
2955
2575
raise KeyError(object_path)
2959
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
2960
out_signature = "a{oa{sa{sv}}}")
2961
def GetManagedObjects(self):
2963
return dbus.Dictionary(
2964
{ client.dbus_object_path:
2966
{ interface: client.GetAll(interface)
2968
client._get_all_interface_names()})
2969
for client in tcp_server.clients.values()})
2971
def client_added_signal(self, client):
2972
"""Send the new standard signal and the old signal"""
2974
# New standard signal
2975
self.InterfacesAdded(
2976
client.dbus_object_path,
2978
{ interface: client.GetAll(interface)
2980
client._get_all_interface_names()}))
2982
self.ClientAdded(client.dbus_object_path)
2984
def client_removed_signal(self, client):
2985
"""Send the new standard signal and the old signal"""
2987
# New standard signal
2988
self.InterfacesRemoved(
2989
client.dbus_object_path,
2990
client._get_all_interface_names())
2992
self.ClientRemoved(client.dbus_object_path,
2995
2579
mandos_dbus_service = MandosDBusService()
2998
2582
"Cleanup function; run on exit"
3002
2585
multiprocessing.active_children()
3004
2586
if not (tcp_server.clients or client_settings):
3033
2615
del client_settings[client.name]["secret"]
3036
with tempfile.NamedTemporaryFile(
3040
dir=os.path.dirname(stored_state_path),
3041
delete=False) as stored_state:
2618
with (tempfile.NamedTemporaryFile
2619
(mode='wb', suffix=".pickle", prefix='clients-',
2620
dir=os.path.dirname(stored_state_path),
2621
delete=False)) as stored_state:
3042
2622
pickle.dump((clients, client_settings), stored_state)
3043
tempname = stored_state.name
2623
tempname=stored_state.name
3044
2624
os.rename(tempname, stored_state_path)
3045
2625
except (IOError, OSError) as e:
3049
2629
except NameError:
3051
2631
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3052
logger.warning("Could not save persistent state: {}"
2632
logger.warning("Could not save persistent state: {0}"
3053
2633
.format(os.strerror(e.errno)))
3055
2635
logger.warning("Could not save persistent state:",
3059
2639
# Delete all clients, and settings from config
3060
2640
while tcp_server.clients:
3061
2641
name, client = tcp_server.clients.popitem()
3063
2643
client.remove_from_connection()
3064
# Don't signal the disabling
2644
# Don't signal anything except ClientRemoved
3065
2645
client.disable(quiet=True)
3066
# Emit D-Bus signal for removal
3067
mandos_dbus_service.client_removed_signal(client)
2648
mandos_dbus_service.ClientRemoved(client
3068
2651
client_settings.clear()
3070
2653
atexit.register(cleanup)
3072
2655
for client in tcp_server.clients.itervalues():
3074
# Emit D-Bus signal for adding
3075
mandos_dbus_service.client_added_signal(client)
2658
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3076
2659
# Need to initiate checking of clients
3077
2660
if client.enabled:
3078
2661
client.init_checker()